<html>
<head><meta charset="utf-8"><title>Safety of inspecting bytes of a repr(rust) type. · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html">Safety of inspecting bytes of a repr(rust) type.</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="176159517"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176159517" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176159517">(Sep 20 2019 at 02:23)</a>:</h4>
<p>Suppose we have an unsafe marker trait for type with no padding bytes:</p>
<div class="codehilite"><pre><span></span><span class="k">pub</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="k">trait</span><span class="w"> </span><span class="n">NoPaddingBytes</span><span class="w"> </span><span class="p">{}</span><span class="w"></span>
</pre></div>


<p>And then we implement it on some of our favorite types. Particularly, say  <code>(u8,u8)</code></p>
<p>Is it safe/sound to then have a function to convert a reference to a NoPaddingBytes value into a properly sized byte slice.</p>
<div class="codehilite"><pre><span></span><span class="k">pub</span><span class="w"> </span><span class="k">fn</span> <span class="nf">bytes_of</span><span class="o">&lt;</span><span class="n">T</span>: <span class="nc">NoPaddingBytes</span><span class="o">&gt;</span><span class="p">(</span><span class="n">t</span>: <span class="kp">&amp;</span><span class="nc">T</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kp">&amp;</span><span class="p">[</span><span class="kt">u8</span><span class="p">]</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">  </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">core</span>::<span class="n">slice</span>::<span class="n">from_raw_parts</span><span class="p">(</span><span class="n">t</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="n">T</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="kt">u8</span><span class="p">,</span><span class="w"> </span><span class="n">size_of</span>::<span class="o">&lt;</span><span class="n">T</span><span class="o">&gt;</span><span class="p">())</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>


<p>EDIT: I'm _thinking_ that the answer is "You can't do that", and scottmcm also figured as much on Discord a little after I posted this, but I thought it was worth asking and we can leave it up for discussion.</p>



<a name="176168501"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176168501" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176168501">(Sep 20 2019 at 06:31)</a>:</h4>
<p>I don't see any immediate problem if (can you add scottmcm's rationale here?) <em>if</em> the <code>NoPaddingBytes</code> impl is justified. But for virtually all repr(rust) types, layout is sufficently unspecified that claiming it has no padding bytes wouldn't be justified.</p>



<a name="176178276"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176178276" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176178276">(Sep 20 2019 at 09:37)</a>:</h4>
<p>and <code>(u8, u8)</code> is <code>repr(rust)</code></p>



<a name="176197096"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176197096" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176197096">(Sep 20 2019 at 14:24)</a>:</h4>
<p><code>(u8,u8)</code> will never have padding bytes, yet it is <code>repr(rust)</code> and inspecting the individual bytes is undefined. Or at least, uh, I think "under defined" is the term that's been used a bit lately, perhaps that. <code>(u8,u8)</code> is always 2 bytes big and neither of the bytes is a padding byte, but you still can't turn <code>&amp;(u8,u8)</code> into <code>&amp;[u8]</code> and look around inside because it's undefined if <code>tuple.0</code> is the same as <code>punned_slice[0]</code>.</p>



<a name="176212596"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176212596" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176212596">(Sep 20 2019 at 17:19)</a>:</h4>
<p>I don't believe it is actually defined that <code>(u8, u8)</code> has no padding. Not even in the UCG which is all provisional and contains errors as well as proposals not yet blessed by the lang team.</p>



<a name="176229607"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176229607" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176229607">(Sep 20 2019 at 20:54)</a>:</h4>
<p>if there's ever a secret padding byte somehow I think you'll get torches and pitchforks</p>



<a name="176229637"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176229637" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176229637">(Sep 20 2019 at 20:54)</a>:</h4>
<p>but sure, perhaps it isn't really defined</p>



<a name="176253972"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176253972" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176253972">(Sep 21 2019 at 07:42)</a>:</h4>
<p>if you don't want padding, make it <code>#[repr(C)]</code></p>



<a name="176253979"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176253979" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176253979">(Sep 21 2019 at 07:43)</a>:</h4>
<p>_I think_ there is an issue open for homogeneous aggregates</p>



<a name="176254049"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176254049" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176254049">(Sep 21 2019 at 07:45)</a>:</h4>
<p><a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/36" target="_blank" title="https://github.com/rust-lang/unsafe-code-guidelines/issues/36">ucg#36</a></p>



<a name="176254164"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176254164" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176254164">(Sep 21 2019 at 07:48)</a>:</h4>
<p><code>(u8, u8, u8, u8)</code> has size 4 but alignment 1</p>



<a name="176254191"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176254191" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176254191">(Sep 21 2019 at 07:48)</a>:</h4>
<p>and right now repr(Rust) could change that to size 4 alignment 4</p>



<a name="176254206"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176254206" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176254206">(Sep 21 2019 at 07:49)</a>:</h4>
<p>it also could change that to size 8 alignment 8 AFAICT</p>



<a name="176254209"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176254209" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176254209">(Sep 21 2019 at 07:49)</a>:</h4>
<p>which gives you 4 bytes of trailing padding</p>



<a name="176255159"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176255159" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176255159">(Sep 21 2019 at 08:15)</a>:</h4>
<p>I can't make a tuple be repr(C) XD</p>



<a name="176258218"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176258218" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176258218">(Sep 21 2019 at 09:52)</a>:</h4>
<p><code>#[repr(C)] pub Foo(u8, u8, u8, u8);</code></p>



<a name="176258655"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176258655" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176258655">(Sep 21 2019 at 10:06)</a>:</h4>
<p>That solves... nothing. It gives no interop with tuple-based APIs, it is a different type (different kind even, so no a priori reason to expect them to have similar rules), and it loses all the convenience that motivate having tuples as built-ins in the first place.</p>



<a name="176260204"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176260204" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176260204">(Sep 21 2019 at 11:01)</a>:</h4>
<p>Well of course you can't interface with tuple based APIs with it</p>



<a name="176260210"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176260210" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176260210">(Sep 21 2019 at 11:01)</a>:</h4>
<p>A tuple-based API expects a <code>repr(Rust)</code> tuple, which might have padding anywhere</p>



<a name="176260329"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176260329" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176260329">(Sep 21 2019 at 11:05)</a>:</h4>
<p>They want a different type with a different layout that has no padding</p>



<a name="176260331"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176260331" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176260331">(Sep 21 2019 at 11:05)</a>:</h4>
<p>That's incompatible with <code>repr(Rust)</code></p>



<a name="176260375"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176260375" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176260375">(Sep 21 2019 at 11:06)</a>:</h4>
<p>Even if we were to support the syntax <code>#[repr(C)] (u8, u8)</code> that would be a different type than <code>(u8, u8)</code></p>



<a name="176260376"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176260376" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176260376">(Sep 21 2019 at 11:06)</a>:</h4>
<p>so doing that fixes nothing</p>



<a name="176260382"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176260382" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176260382">(Sep 21 2019 at 11:06)</a>:</h4>
<p>A tuple-struct solves the same problem in the same way but already works on stable Rust</p>



<a name="176266483"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176266483" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176266483">(Sep 21 2019 at 14:13)</a>:</h4>
<blockquote>
<p>Even if we were to support the syntax #[repr(C)] (u8, u8) that would be a different type than (u8, u8)</p>
</blockquote>
<p>Would be open to <code>#[repr(C) (T, U, ...)</code> if there's desire for that</p>



<a name="176266615"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176266615" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176266615">(Sep 21 2019 at 14:16)</a>:</h4>
<p>If we're talking about working on stable Rust, tuple struct don't have any more layout guarantees than tuples atm (none de jure, very little in UCG other than the special cases for zero and one fields)</p>



<a name="176266679"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176266679" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176266679">(Sep 21 2019 at 14:18)</a>:</h4>
<p>And <code>#[repr(C)] (T, U, ...)</code> is more confusing than helpful. More distinctions in the type system generally hurt interop, and perpetuating the idea <code>repr</code>-ness is a property of every type rather than something that means specific things for specific user-defined types. Either we provide deterministic, predictable layout of tuples or we don't.</p>



<a name="176270745"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176270745" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176270745">(Sep 21 2019 at 16:12)</a>:</h4>
<p>In this case, the creation of any new types is not desired.</p>
<p>I want to have a function like</p>
<div class="codehilite"><pre><span></span><span class="k">fn</span> <span class="nf">bytes_of</span><span class="o">&lt;</span><span class="n">T</span>:<span class="nc">SomeBound</span><span class="o">&gt;</span><span class="p">(</span><span class="n">t</span>: <span class="kp">&amp;</span><span class="nc">T</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kp">&amp;</span><span class="p">[</span><span class="kt">u8</span><span class="p">]</span><span class="w"> </span><span class="p">{}</span><span class="w"></span>
</pre></div>


<p>and then implement SomeBound on all appropriate core/alloc/std types. Currently the bound is <code>Pod</code> since most other casting functions just use <code>Pod</code>.</p>
<p>For the casting case of <code>&amp;T -&gt; &amp;[u8]</code> specifically I wanted to investigate if some sort of lesser bound would usefully be able to add a lot of types that are readable as just bytes but aren't <code>Pod</code> (such as NonNull, NomZeroUsize, etc).</p>



<a name="176271028"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176271028" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176271028">(Sep 21 2019 at 16:20)</a>:</h4>
<p>Isn't that just <code>zerocopy::AsBytes</code>?</p>



<a name="176271115"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176271115" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176271115">(Sep 21 2019 at 16:24)</a>:</h4>
<p>I'm unconvinced about guaranteeing something for tuples only</p>



<a name="176271157"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176271157" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176271157">(Sep 21 2019 at 16:24)</a>:</h4>
<p>this is essentially the discussion about homogeneous agregates</p>



<a name="176271167"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176271167" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176271167">(Sep 21 2019 at 16:25)</a>:</h4>
<p>and all of it applies to homogeneous structs, tuple structs, tuples, and arrays</p>



<a name="176271229"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176271229" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176271229">(Sep 21 2019 at 16:26)</a>:</h4>
<blockquote>
<p>rkruppe 4:16 PM   <br>
If we're talking about working on stable Rust, tuple struct don't have any more layout guarantees than tuples atm</p>
</blockquote>
<p><code>#[repr(C)]</code> tuple structs do</p>



<a name="176271294"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176271294" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176271294">(Sep 21 2019 at 16:28)</a>:</h4>
<p>guaranteeing field order would already be enough for union type punning and transmute (if the transmute succeeds)</p>



<a name="176271316"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176271316" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176271316">(Sep 21 2019 at 16:29)</a>:</h4>
<p>so if and only if the transmute form <code>(T, T)</code> to <code>[T; N]</code> succeeds, then <code>(T, T).i</code> can be accessed via <code>[T; N][i]</code></p>



<a name="176271372"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176271372" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176271372">(Sep 21 2019 at 16:30)</a>:</h4>
<p>we could make that transmute always succeed by guaranteeing that their sizes match, but the size of arrays is constrained by what C specifies</p>



<a name="176271384"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176271384" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176271384">(Sep 21 2019 at 16:31)</a>:</h4>
<p>that would still allow us raising the alignment of aggregates up to the aggregate size if we wanted, but we can't raise it further than that</p>



<a name="176271395"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176271395" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176271395">(Sep 21 2019 at 16:31)</a>:</h4>
<p>so we could raise the alignment of <code>(u8, u8)</code> to <code>2</code></p>



<a name="176271452"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176271452" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176271452">(Sep 21 2019 at 16:33)</a>:</h4>
<p>if we don't want to limit that, we could maybe guarantee that the first field is at offset 0</p>



<a name="176271501"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176271501" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176271501">(Sep 21 2019 at 16:34)</a>:</h4>
<p>that would allow raising the alignment of <code>(u8, u8)</code> to <code>4</code>, which gives it size <code>4</code> , and still allow going from a tuple to an array by using an <code>#[repr(C)] union U { t: (u8, u8), a: [u8; 2] }</code></p>



<a name="176271590"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176271590" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176271590">(Sep 21 2019 at 16:37)</a>:</h4>
<p>So for getting that <code>union</code> to work for type-punning, we just need:</p>
<ul>
<li>The <code>i</code>-th field of homogeneous aggregates with default layout is located at offset <code>i * size_of::&lt;FieldTy&gt;()</code>.</li>
</ul>
<p>This prevents field-reordering optimizations, e.g., from PGO, e.g., if it would make sense to put the i-th field at the front because its hot, this guarantee would prevent that.</p>
<p>This allows raising their alignment arbitrarily high, which would produce trailing padding, so <code>transmute</code> might fail if the size of the aggregates differs. So we can still do optimizations like raising the alignment of <code>(u8, u8, u8, u8)</code> to <code>4</code>. </p>
<p>If we wanted to guarantee that <code>transmute</code> works, we could extend those guarantees with:</p>
<ul>
<li>The size of homogeneous aggregates with default layout is <code>size_of::&lt;FieldTy&gt;() * N</code></li>
</ul>



<a name="176272564"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176272564" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176272564">(Sep 21 2019 at 17:04)</a>:</h4>
<p><span class="user-mention" data-user-id="124289">@rkruppe</span> yes, it's one of the things zerocopy does</p>



<a name="176322322"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176322322" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176322322">(Sep 22 2019 at 19:02)</a>:</h4>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> I'm fairly sure there's an established crate with that exact SomeBound and associated functions you'd expect.</p>



<a name="176322573"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176322573" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176322573">(Sep 22 2019 at 19:10)</a>:</h4>
<p>Oh, sure, and I own one of the best ones in the field, which I recently extracted into its own crate at the request of a user (announcing: bytemuck-0.1 is now on <a href="http://crates.io" target="_blank" title="http://crates.io">crates.io</a>)</p>
<p>The question isn't if we can do it at all, the question is how much we can loosen that bound while remaining sound.</p>



<a name="176323125"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176323125" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176323125">(Sep 22 2019 at 19:26)</a>:</h4>
<p>Depends on how much you want to rely on the rust compiler not having serious performance regressions.</p>



<a name="176323129"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176323129" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176323129">(Sep 22 2019 at 19:26)</a>:</h4>
<p>There are arguments for changing the layout of <code>(u8, u8)</code> slightly, e.g., increase its alignment.</p>



<a name="176323135"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176323135" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176323135">(Sep 22 2019 at 19:27)</a>:</h4>
<p>But that's not free, since it might end up raising the size of some other types</p>



<a name="176323204"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176323204" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176323204">(Sep 22 2019 at 19:29)</a>:</h4>
<p>Just because the language does not guarantee something, does not mean that the behavior will change. It might or might not change. If you need to make an assumption to get something done, and you are aware of the issues and risks, you often can write code that tests your assumptions, so that if they were to change, you'd get notified.</p>



<a name="176324275"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176324275" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176324275">(Sep 22 2019 at 20:05)</a>:</h4>
<p>however, when people use a crate as a dependency the crate's tests aren't run on their machine before you're allowed to build the crate</p>



<a name="176324326"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176324326" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176324326">(Sep 22 2019 at 20:06)</a>:</h4>
<p>so while i might accept such a risk for myself, it would clearly be irresponsible to ship that as a lib</p>



<a name="176327500"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176327500" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176327500">(Sep 22 2019 at 21:50)</a>:</h4>
<p>What about a compile-time assert of some kind?</p>



<a name="176327506"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176327506" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176327506">(Sep 22 2019 at 21:51)</a>:</h4>
<p>If there isn't a good mechanism for that, I'd support adding one.</p>



<a name="176329777"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176329777" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176329777">(Sep 22 2019 at 23:04)</a>:</h4>
<p>There are compile time asserts</p>
<p>in this case,</p>
<ul>
<li>you could assert the size of the tuple type</li>
<li>you could assert the align of the tuple type</li>
</ul>
<p>However, asserting the linearity of the tuple type would be less of a sure thing. Assuming that all <code>(u8,u8)</code> have the same layout then you could do it by making some demo values and asserting that the fields land in the right spots in memory. However, you cannot currently const transmute</p>



<a name="176342629"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176342629" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176342629">(Sep 23 2019 at 06:06)</a>:</h4>
<blockquote>
<p>however, when people use a crate as a dependency the crate's tests aren't run on their machine before you're allowed to build the crate</p>
</blockquote>
<p>That's what <code>assert!</code> is for</p>



<a name="176342648"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176342648" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176342648">(Sep 23 2019 at 06:07)</a>:</h4>
<p><code>assert!(size_of::&lt;(u8,u8)&gt;() == 2);</code></p>



<a name="176342654"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176342654" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176342654">(Sep 23 2019 at 06:07)</a>:</h4>
<p>With optimizations on, the compiler should be able to remove the assert</p>



<a name="176342703"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176342703" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176342703">(Sep 23 2019 at 06:08)</a>:</h4>
<blockquote>
<p>However, you cannot currently const transmute</p>
</blockquote>
<p>Of course you can</p>



<a name="176529947"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176529947" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176529947">(Sep 25 2019 at 03:15)</a>:</h4>
<p>stable? or just with some feature?</p>



<a name="176537401"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176537401" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176537401">(Sep 25 2019 at 06:32)</a>:</h4>
<p>you can use unions in const fns</p>



<a name="176584459"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176584459" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176584459">(Sep 25 2019 at 16:56)</a>:</h4>
<p>That only works with specific types, as I recall, you can't do it generically.</p>



<a name="176585706"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176585706" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176585706">(Sep 25 2019 at 17:10)</a>:</h4>
<p>You sorta can const transmute by using a union in a macro</p>



<a name="176585795"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176585795" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176585795">(Sep 25 2019 at 17:11)</a>:</h4>
<p>Example: <a href="https://github.com/thomcc/bad3d/blob/master/t3m/src/macros.rs#L141-L159" target="_blank" title="https://github.com/thomcc/bad3d/blob/master/t3m/src/macros.rs#L141-L159">https://github.com/thomcc/bad3d/blob/master/t3m/src/macros.rs#L141-L159</a> (it's gross, admittedly)</p>



<a name="176589384"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176589384" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176589384">(Sep 25 2019 at 17:50)</a>:</h4>
<p>FWIW you don't need the <code>ARR</code> const there</p>



<a name="176589487"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176589487" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176589487">(Sep 25 2019 at 17:51)</a>:</h4>
<p>ah, or are you using it for type checking ?</p>



<a name="176589509"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176589509" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176589509">(Sep 25 2019 at 17:51)</a>:</h4>
<p>it might give better errors than omitting it</p>



<a name="176592192"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176592192" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176592192">(Sep 25 2019 at 18:19)</a>:</h4>
<p>Yeah, it's for type checking and so that i don't run code passed into the macro inside an unsafe block</p>



<a name="176600607"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety%20of%20inspecting%20bytes%20of%20a%20repr%28rust%29%20type./near/176600607" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Safety.20of.20inspecting.20bytes.20of.20a.20repr(rust).20type.2E.html#176600607">(Sep 25 2019 at 20:03)</a>:</h4>
<p>admittedly it is a const unsafe block so it probably doesn't really matter... well, maybe. but better safe than sorry</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>